Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Thursday November 24, @12:12PM   Printer-friendly
from the lock-that-elephant-trunk-up-tight dept.

As the open source social media network grabs the spotlight as a Twitter replacement, researchers caution about vulnerabilities:

As Mastodon experiences explosive user growth as a replacement for Twitter, infosec experts are pointing out security holes in the social media network. From an anonymous server collecting user information to configuration errors that create vulnerabilities, the increased popularity of the platform is leading to increased scrutiny of its flaws.

Unlike other social media apps, which have a central authority, Mastodon is a federation of servers that can communicate with each other, but which are maintained and run separately by independent admins. That means different rules, different configurations, and sometimes different software versions could apply to different users and postings.

One of the most popular "instances" — the Mastodon term for individual servers/communities — for the cybersecurity community is infosec.exchange, and its members certainly scrutinize its configuration. Gareth Heyes (@gaz on infosec.exchange), a researcher at PortSwigger, uncovered an HTML injection vulnerability stemming from attributes of the specific software fork used.

In another example from a recent Security Week article, Lenin Alevski (@alevsk on infosec.exchange), a security software engineer at MinIO, pointed out a system misconfiguration that would allow him to download, modify, or delete everything in the instance's S3 cloud storage bucket.

Finally, researcher Anurag Sen (@hak1mlukha on infosec.exchange) discovered an anonymous server that was scraping Mastodon user data.


Original Submission

 
This discussion was created by janrinok (52) for logged-in users only. Log in and try again!
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 4, Insightful) by looorg on Thursday November 24, @01:18PM

    by looorg (578) on Thursday November 24, @01:18PM (#1281461)

    This should probably not come as a great surprise. When it was small and living in obscurity nobody probably bothered to look at it. Now that it becomes "popular" they do. With popularity comes people, and with people comes incentive to monitor or hack it.

    That each instance can install whatever they like, config it however they like probably doesn't help in that regard. That said I'm sure there might eventually be some standardization and configuration war so that someone that wants to put up their own server will probably download settings to fit into a network within the network so to speak. After all if this is done for fun and not profit one can probably not expect the same level of service as say Twitter that employ, or did, people to manage these things fulltime. That shouldn't be a surprise.

    Anonymous servers collecting information about users. That seems to happen with all projects that allow people to set up nodes or servers. TOR has/had the same issue as I recall it. If the userbase is large enough or the information interesting enough things will be monitored by someone.

    Starting Score:    1  point
    Moderation   +2  
       Insightful=1, Interesting=1, Total=2
    Extra 'Insightful' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   4